Why don't you just put a firewall between the machine you want to stay untouched and the Internet. Block all outgoing connection attempts to Microsoft servers. "Firewall block windows update" seems to return relevant results. That seems like a good "big hammer" sort of solution to me.